Cursor 在恶意的 Claude Code 扩展中显示 SSH 后门尝试

网络安全

Cursor 在恶意的 Claude Code 扩展中显示 SSH 后门尝试

在 Google 上的首选来源中添加 Unite.AI

2026年10月29日，Cursor披露了一起安全事件，涉及在其VS代码扩展市场中恶意修改的Anthropic.claude码扩展。 称公司该软件包不是由Anthropic开发的，它运行了代码，试图安装一个持久的SSH后门。 多达5 000个用户受到影响。

在一份安全通知中，称公司将直接接触受影响的用户。 Anthropic的Claude Code扩展版 2.1.313 恶意包于2026年10月29日凌晨2:27到下午1:35在市场上提供。

恶意版本如何行为

Cursor 称修改后的扩展收集主机和用户信息：主机名，用户名，操作系统，架构，主目录路径，环境变量名，工作目录，配置的Git电子邮件地址，以及机器的公共IP地址。

扩展试图在用户授权的 keys文件中添加由攻击者控制的SSH密钥，启用本地SSH服务，并打开反向SSH隧道。 Cursor 称这一步骤在Cursor以管理员权限开始的非常不寻常的情况下会失败，因为恶意代码错误。 该公司补充说，通过提供当地SSH服务，需要行政权利，扩展部分在大多数macOS和Windows主机上没有，因此在这些机器上，攻击者不可能通过隧道登录。 即便如此，扩展仍为新增攻击者SSH密钥，安装持久性，并发送主机细节给攻击者。

为了持久性，Cursor 称有效载荷在macOS或Windows上安装了发射代理机，这是一个计划任务，试图以启动符倒置的方式作为系统运行，而背景脚本大约每60秒重试隧道。 扩展报告通过 HTTP POST 请求托管细节和后门状态到端口8099上的/beacon端口。

Cursor的回应

Cursor 称在发现后立即从市场上移除了恶意版本并阻止了进一步的发售，后为防范而关闭了整个市场。 称公司审计了访问，确认没有其他扩展被篡改，旋转了钥匙，重建了市场，并将其带回网上。

Cursor也与主办攻击者服务器的云提供商称合作将其下线，攻击者服务器已停止运行，使逆向外壳和主机-细节POST失去功能。 称公司的调查结果涉及已查明的包件，该公司没有证据证明其他版本的扩展或正式分发受到影响。

补救措施和指标

Cursor建议任何在接触窗口期间从市场安装或更新到Anthropic.claude-code 2.1.313的人运行其撞击检查，搜索端点，网络，以及发布指标的扩展安装遥测，隔离显示有效载荷执行或后门安装证据的主机，并去除未经授权的SSH密钥，持久性机制，并使用它的补救脚本运行隧道进程，同时评估主机是否应当被重建。 受影响用户应轮流使用来自受影响东道主的全权证书和会话，在受信任的系统工作。

该公司警告说，未完成扩展可能不够，因为有效载荷会丢弃独立持续运行的持久性脚本，而称有限环境可变收藏不排除后来在后门上进行认证访问。

撞击检查寻找攻击者的公钥，标签为svc-遥测，附于SSH授权的 keys文件：macOS上的grep命令，和Windows上的PowerShell检查，覆盖用户授权的 keys文件以及C:\ProgramData\ssh下的管理员授权的 keys文件。 如果找到密钥，机器就会受到影响，在这种情况下，Cursor会引导用户为其平台提供补救脚本。

macOS脚本，补救-macos.sh，必须作为受影响的用户运行而不是作为root运行，而Windows脚本，补救-windows.ps1，必须从有管理员权限的PowerShell会话中运行。 两者都去除恶意延伸，持久性机制，运行中的地道过程，以及攻击者的SSH密钥，如果还剩下什么，则以非零状态退出。

已公布的妥协指标包括修改后的darwin-arm64和win32-x64 VSIX包的SHA-256散列，以及修改后的macOS或Windows 2.1.313扩展文件夹中包含字符串1342.09.82.225和svc-遥测的扩展.js文件。 网络指标包括：攻击者端点134.209.82.225,TCP端口22上隧道@134.209.82.225的倒向SSH目标；8099端口同址的外接信标；127.0.0.1:8099回转信标尝试。 Cursor还列出未经批准的Ssh-ed25519公用钥匙并有指纹SHA256:0Z6R+DF64Do2nwQic8a7kkkDLNNk4 IiK+2U2Rci4htk，一个倒向隧道密钥指纹，macOS和Windows的持久性文件路径——包括一个被标记为com.apple.sysmond的启动代理程序，一个预定任务名为SysMon，以及一个名为sysmon.cmd的启动文件夹倒置脚本——和命令行指示器，包括ssh-N-R，自動Sh-M 0, schtasks/create-tn SysMon，系统设置-setremotelogin，以及一个添加-WindowsCapity命令安装 OpenSSH服务器能力。

Cursor指出，该有效载荷的公开IP搜索是ifconfig.me和api.ipify.org，它们是合法的服务，单靠它们就不是一个指标。 该公司将问题引向了安全@cursor.com.

本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension

Add Unite.AI to your preferred sources on Google

Cursor on October 29, 2026 disclosed a security incident involving a maliciously modified version of the Anthropic.claude-code extension in its VS Code extension Marketplace. The company said the package was not developed by Anthropic and that it ran code attempting to install a persistent SSH backdoor. At most 5,000 users were affected.

In a security notice, the company said it will reach out to affected users directly. The malicious package, version 2.1.313 of Anthropic’s Claude Code extension, was available in the marketplace between about 2:27 a.m. PT and 1:35 p.m. PT on October 29, 2026.

How the Malicious Version Behaves

Cursor said the modified extension collects host and user information: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email address, and the machine’s public IP address.

The extension attempts to add an attacker-controlled SSH key to the user’s authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel. Cursor said this step would fail outside of highly unusual circumstances in which Cursor was started with administrator privileges, because of errors in the malicious code. The company added that enabling the local SSH service requires administrative rights the extension does not have on most macOS and Windows hosts, so on those machines the attacker could not have logged in through the tunnel. Even so, the extension still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker.

For persistence, Cursor said the payload installs a LaunchAgent on macOS or, on Windows, a scheduled task that attempts to run as SYSTEM with a Startup-script fallback, while background scripts retry the tunnel roughly every 60 seconds. The extension reports host details and backdoor status through HTTP POST requests to a /beacon endpoint on port 8099.

Cursor’s Response

Cursor said it removed the malicious version from the marketplace immediately upon detection and blocked further distribution, then shut down the entire marketplace as a precaution. The company said it audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace, and brought it back online.

Cursor also said it worked with the cloud provider hosting the attacker’s server to take it offline, and that the attacker server no longer functions, leaving the reverse shell and the host-detail POST non-functional. The company said its findings concern the identified package and that it has no evidence other versions of the extension, or the official distribution, are affected.

Remediation Steps and Indicators

Cursor advised anyone who installed or updated to Anthropic.claude-code 2.1.313 from its marketplace during the exposure window to run its impact check, search endpoint, network, and extension-installation telemetry for the published indicators, isolate hosts showing evidence of payload execution or backdoor installation, and remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes using its remediation scripts while assessing whether the host should be rebuilt. Affected users should rotate credentials and sessions accessible from affected hosts, working from a trusted system.

The company warned that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts that keep running, and said the limited environment-variable collection does not rule out later credential access over the backdoor.

The impact check looks for the attacker’s public key, labeled svc-telemetry, appended to the SSH authorized_keys file: a grep command on macOS, and a PowerShell check on Windows covering both the user’s authorized_keys file and the administrators_authorized_keys file under C:\ProgramData\ssh. A machine is impacted if the key is found, in which case Cursor directs users to its remediation script for that platform.

The macOS script, remediate-macos.sh, must be run as the affected user rather than as root, and the Windows script, remediate-windows.ps1, must be run from a PowerShell session opened with administrator rights. Both remove the malicious extension, the persistence mechanisms, the running tunnel processes, and the attacker’s SSH key, and they exit with a non-zero status if anything remains.

The published indicators of compromise include SHA-256 hashes for the modified darwin-arm64 and win32-x64 VSIX packages, and a modified extension.js file in the macOS or Windows 2.1.313 extension folder containing the strings 134.209.82.225 and svc-telemetry. Network indicators include the attacker endpoint 134.209.82.225, a reverse SSH target of tunnel@134.209.82.225 on TCP port 22, an external beacon at the same address on port 8099, and a loopback beacon attempt at 127.0.0.1:8099. Cursor also listed the unauthorized ssh-ed25519 public key with fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, a reverse-tunnel key fingerprint, persistence file paths for macOS and Windows — including a LaunchAgent labeled com.apple.sysmond, a scheduled task named SysMon, and a Startup-folder fallback script named sysmon.cmd — and command-line indicators including ssh -N -R, autossh -M 0, schtasks /create /tn SysMon, systemsetup -setremotelogin on, and an Add-WindowsCapability command installing the OpenSSH server capability.

Cursor noted that the payload’s public IP lookups go to ifconfig.me and api.ipify.org, which are legitimate services, and that access to them alone is not an indicator. The company directed questions to security@cursor.com.

Auto-fetched and translated by AI Gem Box. All rights belong to the original author.